Securing online applications and web pages using blockchain

Abstract

Systems, methods, and other embodiments associated with protecting online content are described. In one embodiment, a method includes generating a hashed code and generating an encrypted and signed hash. The method can also include sending the encrypted and signed hash and a domain to a blockchain, causing: the blockchain to request verification of the encrypted and signed hash by a terminal associated with a registrant of the domain; and the terminal associated with the registrant to: (a) decrypt the encrypted and signed hash using a private key to obtain the hashed code, (b) attempt to verify authenticity of the hashed code, and (c) control inclusion of the hashed code in a blockchain record based on a result of the attempt to verify authenticity of the hashed code.

Description

Background Technology

[0001] Traditional methods of protecting data communication from one peer to another involve using the HTTPS protocol, which employs peer-to-peer encryption. This method only prevents data from being intercepted and interpreted as it is being transmitted between the sender and receiver. However, malicious parties have subsequently employed other methods to redirect users to malicious code, such as directly modifying the content of websites or applications, or attempting so-called "man-in-the-middle" attacks.

[0002] An example of tampering with website content is inserting malicious code into it. Attackers can insert data logging features or other such content that allow them to access private information entered into web browser applications.

[0003] In contrast, man-in-the-middle attacks can occur without modifying the content of the original website itself. Instead, the attacker stealthily intercepts and alters communication between computer terminals operated by users who mistakenly believe they are communicating directly with each other. As a concrete example, an attacker could intercept a web browser application's request to retrieve and display a desired website. Instead of directing the web browser to the desired website, the attacker directs it to a different website with a similar appearance. This different website may contain malicious code that could compromise the user's private information.

[0004] As another example of a man-in-the-middle attack, during active eavesdropping, the attacker establishes an independent connection with the victim and relays messages between them to make them believe they are talking directly to each other through a private connection, when in reality the entire conversation is controlled by the attacker. The attacker intercepts all relevant messages passed between the two victims and injects new messages or alters the messages sent by the parties in the conversation.

[0005] Existing attempts to prevent tampering involve performing regular backups of website code. If any changes are made to the website, the website administrator can be alerted. Another approach to protecting online content requires service providers and other entities to proactively search for malicious content over the internet. If any such content is discovered, the service provider communicates with the administrator to notify them of the potential presence of malicious content. This allows the administrator to restore the website or otherwise remove any malicious content. However, such existing measures allow unsuspecting users to access malicious code over the internet or other networks. As a result, users' sensitive information may be compromised until corrective measures are implemented. Summary of the Invention

[0006] In one embodiment of this disclosure, a computer-implemented method is described, as well as a non-transitory computer-readable medium configured with stored computer-executable instructions that, when executed by at least one processor of a computing system, cause the computing system to perform at least the following actions:

[0007] At least the processor hashes the computer code corresponding to the network-accessible content to generate hashed code, where the network-accessible content will be hosted at a network address corresponding to the domain;

[0008] At least the hashed code is encrypted and signed by a processor to generate an encrypted and signed hash, wherein the hashed code is encrypted using: (i) a private key associated with the source of the network-accessible content, and (ii) a public key associated with the domain's registrar; and

[0009] At least by sending the encrypted and signed hash and field to the blockchain via the processor, the following occurs:

[0010] The blockchain request is used by the terminal associated with the domain's registrant to verify the encrypted and signed hash; and

[0011] The terminal associated with the registrant: (a) uses a private key to decrypt the encrypted and signed hash to obtain the hashed code, (b) attempts to verify the authenticity of the hashed code, and (c) based on the result of the attempt to verify the authenticity of the hashed code, controls the inclusion of the hashed code in the blockchain record.

[0012] In another embodiment, the instruction, when executed by at least a processor, also causes:

[0013] If an attempt to verify the authenticity of the hashed code results in the determination that the hashed code is authentic, then: the terminal control associated with the registrant includes the hashed code in the blockchain record by sending the hashed code to the blockchain;

[0014] The blockchain sends a domain confirmation request to the domain name server; and

[0015] Domain Name Server: (i) determines whether the registrant matches a specific registrant in a data structure accessible to the domain, (ii) as a result of the match between the registrant and the specific registrant, sends an approval to the blockchain to include the hashed code in the blockchain record, and (iii) as a result of determining that the registrant does not match the specific registrant, sends an objection to the blockchain to prevent the hashed code from being included in the blockchain record.

[0016] In another aspect of this disclosure, a computing system is described, comprising:

[0017] At least one processor is connected to at least one memory;

[0018] A hash module, stored on a non-transitory computer-readable medium, includes instructions that, when executed by at least a processor, cause the processor to hash computer code corresponding to network-accessible content to generate hashed code, wherein the network-accessible content will be hosted at a network address corresponding to a domain; and

[0019] An encryption module, stored on a non-transitory computer-readable medium, includes instructions that, when executed by at least a processor, cause the processor to:

[0020] The hashed code is encrypted and signed to generate an encrypted and signed hash, wherein the hashed code is encrypted using: (i) a private key associated with the source of the network-accessible content, and (ii) a public key associated with the domain registrant; and

[0021] At least by sending the encrypted and signed hash and field to the blockchain via the processor, the following occurs:

[0022] The blockchain request is used by the terminal associated with the domain's registrant to verify the encrypted and signed hash; and

[0023] The terminal associated with the registrant: (a) uses a private key to decrypt the encrypted and signed hash to obtain the hashed code, (b) attempts to verify the authenticity of the hashed code, and (c) based on the result of the attempt to verify the authenticity of the hashed code, controls the inclusion of the hashed code in the blockchain record. Attached Figure Description

[0024] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate various systems, methods, and other embodiments of this disclosure. It should be understood that element boundaries (e.g., boxes, groups of boxes, or other shapes) shown in the figures represent one embodiment of a boundary. In some embodiments, an element may be implemented as multiple elements or multiple elements may be implemented as a single element. In some embodiments, an element shown as an inner component of another element may be implemented as an outer component, and vice versa. Furthermore, elements may not be drawn to scale.

[0025] Figure 1 An example of a system associated with protecting a user's computer from malicious code in website code is shown.

[0026] Figure 2 It is a flowchart that graphically depicts an illustrative method for verifying the authenticity or integrity of website code in a blockchain.

[0027] Figure 3 It is a flowchart that graphically depicts an illustrative method of a multi-factor authentication process executed by a blockchain based on smart contracts.

[0028] Figure 4 It is a flowchart that graphically depicts the illustrative method of opening website code once blockchain is used to verify that the website code is authentic and free of malicious code.

[0029] Figure 5 Examples of computing systems configured with disclosed example systems and / or methods are shown.

[0030] Figure 6 Another embodiment of a computing system with a disclosed example system and / or method is shown. Detailed Implementation

[0031] This document describes systems and methods for securing website code or other online applications accessible through communication networks using distributed ledger technology, or “blockchain.” This disclosure also describes systems and methods for verifying the authenticity or integrity of website code or other online applications when a user terminal attempts to open or otherwise access the desired online application.

[0032] This system and method can prevent users from opening websites or other online content that have been directly modified with malicious code, or prevent users from opening websites or other online content through man-in-the-middle attacks. Ownership and / or authenticity of the website or other online content can be verified before it is opened. If the attempted verification fails, this system and method will prevent the user's terminal from opening, executing, or otherwise using code to protect user information.

[0033] This system and method cannot prevent the tampering of network-accessible resources or the hijacking of communication between computer terminals. However, it can protect users' computer terminals from maliciously modified websites or other online resources. Users' computer terminals remain protected from such malicious code until the online resources are restored and the malicious code is no longer valid. Therefore, even when the code of a website or other online resource is modified to include malicious code, the user's computer terminal and the information entered into it by the end user are protected. As a result, administrators are given sufficient time to repair or otherwise restore the modified code to its original operational state (e.g., without malicious code), and the malicious code is not widely disseminated.

[0034] For example, computer users have no control over what happens to the code of websites or other online content they access via the internet. Sometimes, hackers can attempt to redirect all communication to a specific website by modifying the computer's hosts file. When a user on an affected computer types a URL into a web browser application, they will be redirected to an unexpected website instead of the actual website correctly associated with that URL. The unexpected website may resemble the actual website corresponding to the URL, making it difficult for users to easily detect this misdirection.

[0035] For websites that utilize users' personal information (such as banking websites), misdirection of website requests is of particular concern. Unintentional websites may include login fields where users enter private information, such as usernames and passwords used to access online financial information. Malicious measures such as data loggers and keystroke trackers allow malicious actors to extract sensitive information (e.g., usernames, passwords, PINs, account numbers, and other sensitive information) entered into or accessed by compromised terminals. Therefore, parties associated with the actual website may suffer losses due to brand reputation damage or financial liability for damages caused by malicious code.

[0036] This disclosure relates to authenticating the ownership and integrity of website code before it is allowed to be opened, using a distributed ledger technology commonly referred to as "blockchain". Although website code is used throughout the disclosure as an example of protected online content, this technology can be used to prevent malicious content from being included in the code of any network-accessible computer.

[0037] The ownership and authenticity of the website code are verified in response to the transmission of a request from a user's computer terminal to open the required online application. This prevents the user's computer from opening websites containing directly injected malicious code or malicious code included through so-called "man-in-the-middle attacks." If verification fails, the user's computer is prevented from opening the website code, thus protecting the user's computer. Such protection will not prevent the website code from being tampered with or communications from being hijacked. However, this technology will prevent the user's computer from opening malicious websites and helps prevent the spread of malicious code.

[0038] One aspect of this technology is protecting users' computers from maliciously modified websites, giving administrators time to fix website code and prevent the spread of malicious code.

[0039] According to this disclosure, to protect website code, the website administrator includes the authentication record of the real website code in a blockchain. To achieve this, the hashing module of the computing device generates a hash of the real website code associated with the website domain on which the real website code will be hosted. The hash of the website code is encrypted and signed by the cryptographic module of the computing device using: (i) a private key associated with the administrator, the developer of the website code, or other authoritative party; and (ii) a public key associated with the registrant of the website domain.

[0040] An encrypted and signed version of the hash associated with the website domain is sent to the blockchain according to a smart contract. The smart contract includes rules defining the terms to be met for including the certified record, which verifies the authenticity of the website code, in the blockchain. Including the certified record in the blockchain means that the certified record is stored on a non-transitory computer-readable medium accessible via the internet, such as a server or other networked computer terminal. The certified record is included in a series of related records derived from derivative works or transactions involving that certified record.

[0041] This series of records is linked in a "chain" and stored by computing devices connected to multiple different networks that reference the authentication record. Even if one record in the series is corrupted, such corruption will differentiate it from the other records in the series, indicating that the corrupted record or the corresponding website code may have been compromised. The interconnected network of computing devices that stores the authentication record and related records is generally referred to herein as a blockchain.

[0042] The transmission of the hashed, encrypted, and signed version to the blockchain causes the blockchain to execute a verification process. As part of this verification process, a smart contract requests the blockchain to identify the registrant responsible for the website domain based on the registrant's public key. To recap, the public key is used as part of the encryption and signing process performed by the aforementioned encryption module. Once the registrant is identified, the blockchain requests the registrant's approval of the signature associated with the hash of the actual website code.

[0043] To approve the inclusion of the authentication record in the blockchain, the smart contract requires the registrant to decrypt the hash using the private key associated with the actual website code. The registrant analyzes the decrypted hash to determine if the signature matches the actual signature known to be associated with the owner of the website domain used to host the actual website code. If the hashed website code is not correctly encrypted, or the signature does not match the domain owner's signature, the authentication record is rejected from being added to the blockchain.

[0044] As a verification result of the registrant's confirmation of the authenticity of the authentication record, a verification notification is transmitted to the blockchain. The verification notification indicates that the authentication record and the website's unencrypted hash code are valid and should be included in the blockchain. In response, and according to the smart contract, the blockchain is prompted to send a second request to an authoritative name server (e.g., a domain name server or "DNS") for redundant verification of the authenticity of the website code.

[0045] The second request used for redundancy verification asks DNS to determine whether the registrant is indeed the designated registrant for the website domain listed in the smart contract of the website code being authenticated. If DNS determines that the registrant is not the designated registrant for the website domain, the redundancy verification fails, and DNS refuses to include the authentication record in the blockchain.

[0046] Once redundancy verification is successfully completed (e.g., DNS determines that the registrant is the designated registrant for the website domain), DNS responds to the blockchain to approve the inclusion of the authentication record in the blockchain. In response to receiving DNS approval, the blockchain is prompted to include the authentication record, which may include the website code and an unencrypted hash of the domain associated with the website code, as part of the distributed ledger maintained by the blockchain. A notification confirming that the authentication record has been approved for inclusion in the blockchain may optionally be sent by the blockchain to the user's computer associated with the party associated with the website code.

[0047] Once included in the blockchain, the authentication record can be used to verify the authenticity and integrity of the website code when an attempt is made to open the website code. As used in this article, an attempt to "open" website code involves a request from the user's computer to obtain and display the website due to the user entering a URL in a browser field or otherwise indicating a desire to display the website. Before allowing a user's computer to open the website code and display the website, the authenticity and integrity of the website code must be verified.

[0048] A web browser running on a user's computer can receive a request from the user to open and display a website. In response, the web browser's hash verification module sends a request for a hash associated with the website code to a web server via a communication network such as the internet. This request causes the web server to return the hash associated with the requested website code to the user's computer before sending the website code to be opened.

[0049] The hash verification module uses the hash returned by the web server to determine whether the returned hash has been verified and included in the authentication record in the blockchain, and is associated with the domain of the website code, as described above. To accomplish this, the hash verification module sends a confirmation request to the blockchain. The confirmation request causes the blockchain to return a hash associated with the domain of the website code. If the hash verification module determines that the hash returned by the web server is not associated with the domain of the website code to be opened, the hash verification fails. Due to unsuccessful hash verification, the hash verification module can issue a warning and prevent the user's computer from obtaining and / or opening the website code from the web server.

[0050] If hash verification is successful (e.g., the hash returned by the web server, included in the authentication record in the blockchain, is associated with the domain to be opened), the content verification module performs content verification. Content verification involves the content verification module sending a request for the website code to the web server via the internet. In response to receiving this request, the web server returns the website code to the user's computer via the internet. The content verification module compares: (i) the website code returned by the web server, with (ii) the hash associated with the domain of the website code previously returned to the hash verification module by the blockchain.

[0051] If the content verification module determines that the domain-related hash in the authentication record returned by the blockchain does not match the returned website code, the content verification module prevents the user's computer from opening the website code. For example, instead of opening the received website code and displaying the corresponding website, the web browser could optionally display an alert to the user.

[0052] However, if the content verification module determines that the domain-related hash in the authentication record in the blockchain corresponds to the returned website code, the content verification module verifies the website code and causes it to open. As a result, a web browser application executed by the user's computer generates a display including the website content.

[0053] refer to Figure 1 This illustration shows an embodiment of a system 100 associated with protecting a user's computer from malicious code on a website. The system includes a management terminal 105 operably connected to a communications network 110 such as the Internet. The management terminal 105 is operable to control the establishment of ownership and authenticity of the website code, allowing reliable verification of the website code before it is allowed to be opened by the user terminal 115. Once established by the management terminal, ownership and authenticity are recorded in an authentication record 120 included in a blockchain 125.

[0054] Management terminal 105 can be operated by a party responsible for the website code (e.g., the developer), hosting the website code, or otherwise involved in making the website code accessible to the network. Management terminal 105 includes a hash module 130 that hashes the actual website code to generate hashed code 135.

[0055] The hashing performed by hashing module 130 involves taking an input string of any length and generating an output string of a fixed length. For example, website code and the corresponding field can be considered as input to the hashing algorithm. Regardless of the size of the input, the output for each hash is equal.

[0056] The hashing algorithm used by hash module 130 may optionally be deterministic. Therefore, each time the same input (e.g., website code and corresponding domain) is processed according to the algorithm, the same hashed code 135 is output. However, reversing the hashed code 135 (i.e., determining the content used as input for the hashing algorithm based on the output) may optionally be impractical. Examples of hashing algorithms include, but are not limited to, MD5, SHA-1, SHA256, SHA512, etc.

[0057] The management terminal 105 also includes an encryption module 140 operable to generate an encrypted and signed hash 145 based on the hashed code 135. A private key associated with the source of the website code (e.g., the software developer) and a public key associated with the registrant of the domain on which the website is to be hosted are used by the encryption module 140 to generate the encrypted and signed hash 145.

[0058] The management terminal 105 sends the encrypted and signed hash 145, along with the smart contract and a request to verify the encrypted and signed hash 145, to the blockchain 125. As described in more detail below, the verification of the encrypted and signed hash 145 by the blockchain 125 involves satisfying the rules included in the smart contract. In one embodiment, this verification involves a multi-step verification process.

[0059] For example, as part of the verification process, a smart contract requests blockchain 125 to identify the registrant responsible for the website domain based on the registrant's public key included in the encrypted and signed hash 145. Once the registrant is identified, blockchain 125 sends the encrypted and signed hash 145 along with a request to decrypt the encrypted and signed hash 145 to the server 150 associated with the registrant and approves the signature associated with the encrypted and signed hash 145.

[0060] To approve the inclusion of authentication record 120 in blockchain 125, a smart contract requests (or blockchain 125 requests based on a smart contract) that registration server 150 use its private key to decrypt the hash. The private key corresponds to the public key included in the encrypted and signed hash 145. Registration server 150 analyzes the now-decrypted hash to determine if the signature matches the actual signature known to be associated with the owner of the website domain used to host the real website code. If the hashed website code is not correctly encrypted (e.g., cannot be decrypted by registration server 150 using its private key), or the signature does not match the domain owner's signature, the addition of authentication record 120 to blockchain 125 is rejected.

[0061] If the encrypted and signed hash 145 is correctly encrypted and the signature matches the domain owner's signature, the registration server 150 sends a verification notification to the blockchain 125. The registration server 150 also decrypts the encrypted and signed hash 145 and sends the decrypted hash to the blockchain 125. This verification notification instructs the signature to match the registered owner of the domain associated with the website code, and the authentication record 120 associated with the website code should be included in the blockchain 125.

[0062] As a result of receiving the verification notification, and in accordance with the smart contract, Blockchain 125 sends a second request to DNS 155. The second request is used for redundant verification of the authenticity of the website code.

[0063] The second request instructs DNS 155 to determine whether the registrant is indeed the designated registrant of the website domain listed in the decrypted hash of the website code being authenticated. If DNS 155 determines that the registrant is not the designated registrant of the website domain, the redundant verification fails, and DNS 155 prevents authentication record 120 from being included in blockchain 125.

[0064] Once the redundancy verification is successfully completed (e.g., DNS 155 determines that the registrant is the designated registrant for the website domain), DNS 155 responds to blockchain 125, approving the inclusion of authentication record 120 in blockchain 125.

[0065] In response to receiving approval from DNS 155, authentication record 120 is included in blockchain 125, optionally as a primary node, thereby initiating a new chain of the website code. Authentication record 120 may include the website code and an unencrypted hash of the domain associated with the website code, as part of a distributed ledger maintained on blockchain 125. Notification confirming that authentication record 120 has been approved for inclusion in blockchain 125 may optionally be sent by blockchain 125 to management terminal 105.

[0066] User terminal 115 can access authentication record 120 (once included in blockchain 125) to verify the authenticity and integrity of the website code before opening it. User terminal 115 includes hash verification module 160, which can form a component of a web browser application. As a result of a user inputting an instruction to user terminal 115 to open the website code, hash verification module 160 requests the hash of the website from web server 165 hosting the website code.

[0067] Web server 165 responds to the request by sending the hash of the website back to hash verification module 160. The returned hash of the website includes the hash of the domain associated with the website and the hash of the website code. Hash verification module 160 then uses blockchain 125 to verify the authenticity of the received website hash.

[0068] For example, hash verification module 160 sends the received hash of a website to blockchain 125. Blockchain 125 determines whether authentication record 120 includes the hash of the website. If so, the blockchain also determines whether the domain sent by hash verification module 160 is related to the domain in authentication record 120. If so, blockchain 125 sends a verification notification to user terminal 115, such as the hash of the website related to the domain to be opened from authentication record 120. Since the authenticity and integrity of authentication record 120 have been verified, the hash sent by the blockchain corresponds to the website and contains no malicious code.

[0069] User terminal 115 also includes a content verification module 170. Once user terminal 115 receives a verification notification, content verification module 170 (which may optionally be a component of a web browser application) requests website code from web server 165. After receiving the website code from the web server, content verification module 170 compares the content of the website code with the hash representation received from blockchain 125. If the comparison leads to a determination that the website code matches the content based on the hash received from blockchain 125, content verification module 170 concludes that the website code can be securely opened. As a result, content verification module 170 causes the web browser application to open the website code.

[0070] If the comparison results in a determination that the website code does not match the content based on the hash received from blockchain 125, the content verification module 170 concludes that opening the website code is insecure. As a result, the content verification module 170 prevents web browser applications from opening the website code, thereby protecting the user terminal 115 from potentially malicious code.

[0071] In one embodiment, one or more of the management terminal 105, user terminal 115, registration terminal 150, DNS 155, and web server 165 (each of which is generally referred to as a device) may be a computing / data processing system comprising a collection of applications or distributed applications for an enterprise organization. The applications and devices may be configured to operate with or implemented as cloud-based network systems, Software as a Service (SaaS) architectures, or other types of networked computing solutions. In one embodiment, the devices are centralized server-side applications that provide at least the functionality disclosed herein and are accessed by a number of users via computing devices / terminals communicating with system 100 (which acts as a server) through a computer network.

[0072] Furthermore, in one embodiment, one or more components described herein are configured as program modules stored in a non-transitory computer-readable medium. The program modules are configured with stored instructions that, when executed by at least one computer processor, cause a computing device (such as a reference dextral) to... Figure 5 The computing device 500 described herein performs one or more of the corresponding functions described herein. The functions / actions performed herein are performed at least in part by the processor accessing and interacting with the memory device to read / write data and values ​​to and from the memory device. None of the functions / actions described or claimed herein are performed manually or in the human brain.

[0073] Figure 2 This is a flowchart graphically depicting an embodiment of a method for establishing website code as genuine and free of malicious code using blockchain 125. At box 200, management terminal 105 hashes the website code, which will be hosted at a network address registered to a domain of a party associated with the website code. Depending on the specific hashing algorithm used, the hash produces an output of fixed length.

[0074] At box 205, the hashed code is encrypted and signed. The following are used to encrypt and sign the hashed code: (i) a private key associated with the developer or other source of the website code, and (ii) a public key associated with the domain registrant. The private key allows the registration server 150 to decrypt the encrypted and signed hash 145, and the registrant's public key allows the blockchain to identify the registration server 150 to which the encrypted and signed hash 145 will be sent.

[0075] At box 210, the encrypted and signed hash 145 is sent to the blockchain via communication network 110. A smart contract (which defines the rules or terms for authenticating website code in the form of non-malicious code) is sent along with the encrypted and signed hash 145. The encrypted and signed hash 145 and the smart contract cause the blockchain 125 to perform a multi-step authentication process, as described in the reference. Figure 3 As described, this includes the authentication record 120 containing the website code in blockchain 125.

[0076] Figure 3 This is a flowchart graphically depicting an embodiment of a multi-step authentication method executed by blockchain 125 to establish website code as authentic. At box 300, the blockchain receives a combination of encrypted and signed hash 145 and a smart contract via communication network 110. The smart contract defines the process for authenticating website code, as described below.

[0077] At box 305, blockchain 125 uses the registrant's public key, included in the encrypted and signed hash 145, to route the encrypted and signed hash 145 to the appropriate registration server 150. Once the registration server 150 is identified, blockchain 125 sends the encrypted and signed hash 145 to that registration server 150 at box 310. The transmission of the encrypted and signed hash 145 includes a request to the registration server 150 to decrypt the encrypted and signed hash 145. It also requests the registration server 150 to verify that the signature of the developer or other party associated with the website code corresponds to a domain of the website code.

[0078] See the following reference Figure 4 After the described attempt to decrypt and verify the signature of the encrypted and signed hash 145, the registration server 150 returns the result of the attempt to the blockchain 125. At box 315, the blockchain 125 determines whether the registration server 150's decryption and signature verification attempt was successful. If not, at box 320, it prevents the authentication record 120 from being added to the blockchain 125. If yes, at box 325, the blockchain continues the multi-step authentication process by requesting confirmation from DNS 155 that the registrant is designated for the domain associated with the website code. The decrypted hash is also returned to the blockchain 125 by the registration server 150.

[0079] If, at box 330, blockchain 125 determines that DNS 155 failed to indicate that the registrant was designated for the domain associated with the website code, then blockchain 125 prevents the addition of authentication record 120 to blockchain 125. If blockchain 125 determines that DNS 155 has determined that the registrant was designated for the domain associated with the website code, then at box 340, blockchain 125 adds authentication record 120 to blockchain 125.

[0080] Figure 4 This is a flowchart graphically depicting one embodiment of a method for opening website code once it has been determined using Blockchain 125 that the website code is authentic and free of malicious code. At box 400, the web browser receives a request to open the website code. This request may be received in response to entering a URL or network address into an address field of a user interface generated by the web browser's execution.

[0081] At box 405, instead of immediately requesting and opening the website code, hash verification module 160 requests the page hash corresponding to the website code from web server 165. At box 410, the page hash is sent by hash verification module 160 to blockchain 125 for verification based on authentication record 120.

[0082] At box 415, blockchain 125 determines whether the page hash is included in authentication record 120, and if so, at box 420, it determines whether the page hash is associated with a domain of the website code. If the determination at box 415 or box 420 is negative, then at box 425, the communication received from blockchain 125 by hash verification module 160 prevents the web browser application from opening the website code. Otherwise, at box 430, blockchain 125 returns the true page hash corresponding to the website code from authentication record 120.

[0083] Content verification module 170 then requests the website code from web server 165 at box 435. At box 440, content verification module 170 determines whether the true page hash from authentication record 120 in blockchain 125 corresponds to the website code received from web server 165. If not, at box 445, content verification module 170 prevents the web browser from opening the website content. Otherwise, at box 450, content verification module 170 allows the web browser application to open the website content.

[0084] Computing device examples

[0085] Figure 5 and 6 Example computing devices 500 and 600, configured and / or programmed, are illustrated with one or more example systems and methods and / or equivalents described herein. Figure 5As shown, the example computing device 500 may be a computer 515 including a processor 502, a memory 535, and an input / output port 545 operatively connected via a bus 525. In one example, the computer 515 may include logic for hashing module 130 and encryption module 140 configured to facilitate hashing and encryption of website code as described herein. In various examples, the logic may be implemented in hardware, a non-transitory computer-readable medium having storage instructions, firmware, and / or combinations thereof. While the logic for hashing module 130 and encryption module 140 is shown as a hardware component attached to bus 525, it should be understood that in other embodiments, the logic may be implemented in processor 502, stored in memory 535, or stored on disk 555 or other non-transitory computer-readable medium 505.

[0086] In one embodiment, the logic or computer 515 is a means (e.g., structure: hardware, non-transitory computer-readable medium, firmware) for performing the described actions. In some embodiments, the computing device may be a server operating in a cloud computing system, a server configured with a Software as a Service (SaaS) architecture, a smartphone, a laptop computer, a tablet computing device, etc.

[0087] The device can be implemented as, for example, an ASIC programmed to hash and / or encrypt website code as described herein. The device can also be implemented as storing computer-executable instructions, which are presented to the computer 515 as data 510 temporarily stored in memory 535 and then executed by processor 502.

[0088] The logic may also provide means (e.g., hardware, a non-transitory computer-readable medium storing executable instructions, firmware) for performing the hashing and encryption methods described herein.

[0089] Generally describing an example configuration of computer 515, processor 502 can be a variety of processors, including dual-microprocessor and other multiprocessor architectures. Memory 535 can include volatile memory and / or non-volatile memory. Non-volatile memory can include, for example, ROM, PROM, etc. Volatile memory can include, for example, RAM, SRAM, DRAM, etc.

[0090] Storage disk 555 can be operatively connected to computer 515 via, for example, an input / output (I / O) interface (e.g., a card, device) 540, an I / O controller 530, and an input / output port 545. Disk 555 can be, for example, a hard disk drive, solid-state drive, floppy disk drive, magnetic tape drive, Zip drive, flash memory card, memory stick, etc. Furthermore, disk 555 can be a CD-ROM drive, CD-R drive, CD-RW drive, DVD ROM, etc. For example, memory 535 can store processes and / or data 510. Disk 555 and / or memory 535 can store an operating system that controls and allocates resources of computer 515.

[0091] Computer 515 can interact with input / output (I / O) devices via I / O interface 540 and input / output port 545. Input / output devices can be, for example, keyboards, microphones, pointing and selection devices, cameras, video cards, monitors, disks 555, network devices 550, etc. Input / output port 545 can include, for example, serial ports, parallel ports, and USB ports.

[0092] Computer 515 can operate in a network environment and can therefore be connected to network device 550 via I / O interface 540 and / or I / O port 545. Through network device 550, computer 515 can interact with the network. Through the network, computer 515 can be logically connected to a remote computer. Networks that computer 515 can interact with include, but are not limited to, LANs, WANs, and other networks.

[0093] like Figure 6 As shown, the example computing device 600 may be a computer 615 including a processor 602, a memory 635, and an input / output port 645 operatively connected via a bus 625. In one example, the computer 615 may include logic for hash verification module 130 and content verification module 170 configured to facilitate verification of the authenticity of website code before opening such website code, as described herein. In various examples, the logic may be implemented in hardware, a non-transitory computer-readable medium having storage instructions, firmware, and / or combinations thereof. While the logic for hash verification module 130 and content verification module 170 is shown as a hardware component attached to bus 625, it should be understood that in other embodiments, the logic may be implemented in processor 602, stored in memory 635, or stored in disk 655 or other non-transitory computer-readable medium 605.

[0094] In one embodiment, the logic or computer 615 is a means (e.g., structure: hardware, non-transitory computer-readable medium, firmware) for performing the described actions. In some embodiments, the computing device may be a server operating in a cloud computing system, a server configured with a Software as a Service (SaaS) architecture, a smartphone, a laptop computer, a tablet computing device, etc.

[0095] The device can be implemented as, for example, an ASIC programmed to hash and / or encrypt website code as described herein. The device can also be implemented as storing computer-executable instructions, which are presented to computer 615 as data 610 temporarily stored in memory 635 and then executed by processor 602.

[0096] The logic may also provide means (e.g., hardware, a non-transitory computer-readable medium storing executable instructions, firmware) for performing the methods for verifying the authenticity of this website.

[0097] Generally describing an example configuration of computer 615, processor 602 can be a variety of processors, including dual-microprocessor and other multiprocessor architectures. Memory 635 can include volatile memory and / or non-volatile memory. Non-volatile memory can include, for example, ROM, PROM, etc. Volatile memory can include, for example, RAM, SRAM, DRAM, etc.

[0098] Storage disk 655 can be operatively connected to computer 615 via, for example, an input / output (I / O) interface (e.g., a card, device) 640, an I / O controller 630, and an input / output port 645. Disk 655 can be, for example, a hard disk drive, solid-state drive, floppy disk drive, magnetic tape drive, Zip drive, flash memory card, memory stick, etc. Furthermore, disk 655 can be a CD-ROM drive, CD-R drive, CD-RW drive, DVD ROM, etc. For example, memory 635 can store processes and / or data 610. Disk 655 and / or memory 635 can store an operating system that controls and allocates resources of computer 615.

[0099] Computer 615 can interact with input / output (I / O) devices via I / O interface 640 and input / output port 645. Input / output devices can be, for example, keyboards, microphones, pointing and selection devices, cameras, video cards, monitors, disks 655, network devices 650, etc. Input / output port 645 can include, for example, serial ports, parallel ports, and USB ports.

[0100] Computer 615 can operate in a network environment and can therefore be connected to network device 650 via I / O interface 640 and / or I / O port 645. Through network device 650, computer 615 can interact with the network. Through the network, computer 615 can be logically connected to a remote computer. Networks with which computer 615 can interact include, but are not limited to, LANs, WANs, and other networks.

[0101] Definitions and other embodiments

[0102] In another embodiment, the described methods and / or their equivalents may be implemented using computer-executable instructions. Thus, in one embodiment, a non-transitory computer-readable / storage medium is configured with stored computer-executable instructions of an algorithm / executable application, which, when executed by a machine(s), cause the machine(s) (and / or associated components) to perform the methods. Example machines include, but are not limited to, processors, computers, servers operating in cloud computing systems, servers configured in a Software-as-a-Service (SaaS) architecture, smartphones, etc. In one embodiment, a computing device is implemented using one or more executable algorithms configured to perform any of the disclosed methods.

[0103] In one or more embodiments, the disclosed method or its equivalent is performed by any of: computer hardware configured to perform the method; or computer instructions embodied in a module stored in a non-transitory computer-readable medium, wherein the instructions are configured to execute an algorithm that is configured to perform the method when executed by at least a processor of a computing device.

[0104] Although, for the sake of simplicity, the methods shown in the figures are represented and described as a series of boxes representing the algorithm, it should be understood that these methods are not restricted by the order of the boxes. Some boxes may occur in a different order than those shown and described, and / or simultaneously with other boxes. Furthermore, example methods may be implemented using fewer than all the boxes shown. Boxes may be combined or separated into multiple actions / components. Additionally, supplementary and / or alternative methods may employ additional actions not shown in the boxes.

[0105] The following includes definitions of the selected terms used in this document. The definitions include various examples and / or forms of components that fall within the scope of the terms and can be used for implementation. These examples are not intended to be restrictive. Both singular and plural forms of the terms may be included in the definitions.

[0106] References to "an embodiment," "an embodiment," "an example," "an example," etc., as described herein, indicate that the embodiments (one or more) or examples (one or more) so described may include a particular feature, structure, characteristic, attribute, element, or limitation, but not every embodiment or example must include that particular feature, structure, characteristic, attribute, element, or limitation. Furthermore, the repeated use of the phrase "in one embodiment" does not necessarily refer to the same embodiment, although it may.

[0107] ASIC: Application-Specific Integrated Circuit.

[0108] CD: Optical disc.

[0109] CD-R: Can record CDs.

[0110] CD-RW: Rewritable CD.

[0111] DVD: Digital multifunction disc and / or digital video disc.

[0112] HTTP: Hypertext Transfer Protocol.

[0113] LAN: Local Area Network.

[0114] PCI: Peripheral Component Interconnect.

[0115] PCIE: PCI Express.

[0116] RAM: Random Access Memory.

[0117] DRAM: Dynamic RAM.

[0118] SRAM: Synchronous RAM.

[0119] ROM: Read-only memory.

[0120] PROM: Programmable ROM.

[0121] EPROM: Erasable PROM.

[0122] EEPROM: Electrically Erasable Proto-ROM.

[0123] SQL: Structured Query Language.

[0124] OQL: Object Query Language.

[0125] USB: Universal Serial Bus.

[0126] XML: Extensible Markup Language.

[0127] WAN: Wide Area Network.

[0128] As used herein, a "data structure" is an organization of data in a computing system stored in memory, storage devices, or other computerized systems. A data structure can be any of, for example, a data field, a data file, a data array, a data record, a database, a data table, a graph, a tree, a linked list, etc. A data structure can be formed from and contain many other data structures (e.g., a database includes many data records). Other examples of data structures are also possible according to other embodiments.

[0129] As used herein, "computer-readable medium" or "computer storage medium" refers to a non-transitory medium that stores instructions and / or data configured to perform one or more of the disclosed functions when executed. In some embodiments, data may be used as instructions. Computer-readable media may take the form of, but is not limited to, non-volatile and volatile media. Non-volatile media may include, for example, optical discs, magnetic disks, etc. Volatile media may include, for example, semiconductor memory, dynamic memory, etc. Common forms of computer-readable media may include, but are not limited to, floppy disks, floppy disks, hard disks, magnetic tapes, other magnetic media, application-specific integrated circuits (ASICs), programmable logic devices, optical discs (CDs), other optical media, random access memory (RAM), read-only memory (ROM), memory chips or cards, memory sticks, solid-state storage devices (SSDs), flash drives, and other media in which a computer, processor, or other electronic device may function. Each type of medium, if selected for implementation in one embodiment, may include stored instructions of an algorithm configured to perform one or more of the disclosed and / or claimed functions.

[0130] As used herein, “logic” means a component implemented using computer or electronic hardware, a non-transitory medium having instructions for an executable application or program module stored therein, and / or a combination thereof, to perform any function or action disclosed herein, and / or cause a function or action from another logic, method, and / or system to be performed as disclosed herein. Equivalent logic may include firmware, a microprocessor programmed with an algorithm, discrete logic (e.g., an ASIC), at least one circuit, analog circuitry, digital circuitry, a programmable logic device, a memory device containing algorithm instructions, and so on, any of which may be configured to perform one or more of the disclosed functions. In one embodiment, logic may include one or more gates, combinations of gates, or other circuit components configured to perform one or more of the disclosed functions. In the case of describing multiple logics, the multiple logics may be combined into one logic. Similarly, in the case of describing a single logic, the single logic may be distributed among multiple logics. In one embodiment, one or more of these logics are corresponding structures associated with performing the disclosed and / or claimed functions. The type of logic to be implemented may be selected based on required system conditions or specifications. For example, hardware implementation of the function would be chosen if higher speed is considered. If lower cost is a consideration, stored instructions / executable applications will be chosen to implement the functionality.

[0131] An "operable connection," or a connection through which entities are "operably connected," is a connection in which signals, physical communications, and / or logical communications can be sent and / or received. An operable connection may include physical interfaces, electrical interfaces, and / or data interfaces. An operable connection may include different combinations of interfaces and / or connections sufficient to allow operable control. For example, two entities may be operably connected to transmit signals to each other directly or through one or more intermediate entities (e.g., processors, operating systems, logic, non-transitory computer-readable media). Logical and / or physical communication channels can be used to create an operable connection.

[0132] As used herein, “user” includes, but is not limited to, one or more persons, computers or other devices, or a combination of these.

[0133] Although the disclosed embodiments have been described and illustrated in considerable detail, it is not intended to limit the scope of the appended claims or restrict them in any way to such detail. Of course, it is impossible to describe every conceivable combination of components or methods for the purpose of describing various aspects of the subject matter. Therefore, this disclosure is not limited to the specific details or illustrative examples shown and described. Consequently, this disclosure is intended to include changes, modifications, and variations that fall within the scope of the appended claims and their equivalents.

[0134] With regard to the terms “comprising” or “including” as used in the specific embodiments or claims, they are intended to be inclusive in a manner similar to the term “comprising” as interpreted when used as a transition word in the claims.

[0135] With regard to the term "or" (e.g., A or B) used in the specific embodiments or claims, it is intended to mean "A or B or both". When the applicant intends to indicate "only A or B and not both", the phrase "only A or B and not both" will be used. Therefore, the term "or" as used herein is inclusive rather than exclusive.

Claims

1. A non-transitory computer-readable medium storing computer-executable instructions, said instructions, when executed by at least one processor of a computing system, causing the computing system to: The processor at least hashes the computer code corresponding to the network-accessible content to generate hashed code, wherein the network-accessible content will be hosted at a network address corresponding to a domain. The hashed code is encrypted and signed by at least the processor to generate an encrypted and signed hash, wherein the hashed code is encrypted using: (i) a private key associated with the source of the content accessible to the network, and (ii) a public key associated with the registrant of the domain; as well as The encrypted and signed hash and the field are sent to the blockchain via at least the processor, wherein the instructions include further instructions that, when executed by at least the processor, cause: (i) The blockchain request is made by a terminal associated with the registrant of the domain to verify the encrypted and signed hash; as well as (ii) The terminal associated with the registrant: (a) decrypts the encrypted and signed hash using the private key to obtain the hashed code, (b) attempts to verify the authenticity of the hashed code, and (c) based on the result of the attempt to verify the authenticity of the hashed code, controls the inclusion of the hashed code in the blockchain record.

2. The non-transitory computer-readable medium of claim 1, wherein the instructions, when executed by at least the processor, further cause: If the attempt to verify the authenticity of the hashed code results in the determination that the hashed code is authentic, then the terminal control associated with the registrant includes the hashed code in the blockchain record by sending the hashed code to the blockchain; The blockchain sends a domain confirmation request to the domain name server; as well as The domain name server: (i) determines whether the registrant matches a specific registrant of the domain in a data structure accessible by the domain name server; (ii) as a result of a match between the registrant and the specific registrant, sends an approval to the blockchain to result in the inclusion of the hashed code in the blockchain record; and (iii) as a result of determining that the registrant does not match the specific registrant, sends an objection to the blockchain to prevent the inclusion of the hashed code in the blockchain record.

3. The non-transitory computer-readable medium of claim 1, further comprising instructions that, when executed by at least the processor, cause the computing system to: In response to a user terminal attempting to access network-accessible content at the network address, before opening the network-accessible content on the user terminal: A second hashed code of the network-accessible content is generated by a web server that hosts the network-accessible content at the network address; Attempt to verify the second hashed code against the hashed code in the blockchain record; as well as Based on the result of the attempt to verify the second hashed code, control is exercised to open the network-accessible content on the user terminal.

4. The non-transitory computer-readable medium of any one of claims 1, 2, or 3, wherein the instructions, when executed, cause the terminal associated with the registrant to attempt to verify the authenticity of the hashed code by determining whether the signature of the encrypted and signed hash corresponds to a party associated with the domain.

5. The non-transitory computer-readable medium of any one of claims 1, 2, or 3, wherein the instructions, when executed, cause: if the attempt to verify the authenticity of the hashed code fails, the terminal associated with the registrant prevents the inclusion of the hashed code in the blockchain record, and the hashed code is not verified as authentic.

6. A computing system, comprising: At least one processor is connected to at least one memory; A hashing module, stored on a non-transitory computer-readable medium, includes instructions that, when executed by at least the processor, cause the processor to hash computer code corresponding to network-accessible content to generate hashed code, wherein the network-accessible content will be hosted at a network address corresponding to a domain. as well as An encryption module, stored on a non-transitory computer-readable medium, includes instructions that, when executed by at least the processor, cause the processor to: The hashed code is encrypted and signed to generate an encrypted and signed hash, wherein the hashed code is encrypted using: (i) a private key associated with the source of the content accessible to the network, and (ii) a public key associated with the registrant of the domain; as well as Sending the encrypted and signed hash and the field to the blockchain via at least the processor results in: (i) The blockchain request is made by a terminal associated with the registrant of the domain to verify the encrypted and signed hash; as well as (ii) The terminal associated with the registrant: (a) decrypts the encrypted and signed hash using the private key to obtain the hashed code, (b) attempts to verify the authenticity of the hashed code, and (c) based on the result of the attempt to verify the authenticity of the hashed code, controls the inclusion of the hashed code in the blockchain record.

7. The computing system of claim 6, wherein the encryption module further comprises instructions that, when executed by at least the processor, cause: If the attempt to verify the authenticity of the hashed code results in the determination that the hashed code is authentic, then the terminal control associated with the registrant includes the hashed code in the blockchain record by sending the hashed code to the blockchain; The blockchain sends a domain confirmation request to the domain name server; as well as The domain name server: (i) determines whether the registrant matches a specific registrant of the domain in a data structure accessible by the domain name server; (ii) as a result of a match between the registrant and the specific registrant, sends an approval to the blockchain to result in the inclusion of the hashed code in the blockchain record; and (iii) as a result of determining that the registrant does not match the specific registrant, sends an objection to the blockchain to prevent the inclusion of the hashed code in the blockchain record.

8. The computing system of claim 6, wherein, The encryption module further includes instructions that, when executed by at least the processor, cause the computing system to: In response to a user terminal attempting to access network-accessible content at the network address, before opening the network-accessible content on the user terminal: A second hashed code of the network-accessible content is generated by a web server that hosts the network-accessible content at the network address; Attempt to verify the second hashed code against the hashed code in the blockchain record; as well as Based on the result of the attempt to verify the second hashed code, control is exercised to open the network-accessible content on the user terminal.

9. The computing system of any one of claims 6, 7, or 8, wherein the terminal associated with the registrant attempts to verify the authenticity of the hashed code by determining whether the signature of the encrypted and signed hash corresponds to a party associated with the domain.

10. The computing system as described in any one of claims 6, 7, or 8, wherein, If the attempt to verify the authenticity of the hashed code fails, the terminal associated with the registrant prevents the hashed code from being included in the blockchain record, and the hashed code is not verified as authentic.

11. A computer-implemented method, the method comprising: At least one processor hashes the computer code corresponding to network-accessible content to generate hashed code, wherein the network-accessible content will be hosted at a network address corresponding to a domain. The hashed code is encrypted and signed by at least the processor to generate an encrypted and signed hash, wherein the hashed code is encrypted using: (i) a private key associated with the source of the content accessible to the network, and (ii) a public key associated with the registrant of the domain; as well as Sending the encrypted and signed hash and the field to the blockchain via at least the processor results in: (i) The blockchain request is made by a terminal associated with the registrant of the domain to verify the encrypted and signed hash; as well as (ii) The terminal associated with the registrant: (a) decrypts the encrypted and signed hash using the private key to obtain the hashed code, (b) attempts to verify the authenticity of the hashed code, and (c) based on the result of the attempt to verify the authenticity of the hashed code, controls the inclusion of the hashed code in the blockchain record.

12. The method of claim 11, wherein sending the encrypted and signed hash and the field to the blockchain further results in: If the attempt to verify the authenticity of the hashed code results in the determination that the hashed code is authentic, then the terminal control associated with the registrant includes the hashed code in the blockchain record by sending the hashed code to the blockchain; The blockchain sends a domain confirmation request to the domain name server; as well as The domain name server: (i) determines whether the registrant matches a specific registrant of the domain in a data structure accessible by the domain name server; (ii) as a result of a match between the registrant and the specific registrant, sends an approval to the blockchain to result in the inclusion of the hashed code in the blockchain record; and (iii) as a result of determining that the registrant does not match the specific registrant, sends an objection to the blockchain to prevent the inclusion of the hashed code in the blockchain record.

13. The method of claim 12, further comprising: The processor at least receives a notification that the hashed code verification has passed due to the match between the registrant and the specific registrant, so as to be included in the blockchain record.

14. The method of any one of claims 11, 12, or 13, wherein sending the encrypted and signed hash and the domain to the blockchain results in: the terminal associated with the registrant attempting to verify the authenticity of the hashed code by determining whether the signature of the encrypted and signed hash corresponds to a party associated with the domain.

15. The method of any one of claims 11, 12, or 13, wherein sending the encrypted and signed hash and the field to the blockchain results in: if the attempt to verify the authenticity of the hashed code fails, the terminal associated with the registrant prevents the hashed code from being included in the blockchain record, and the hashed code is not verified as authentic.

Images